The WP Posts Password Batch Manager plugin up to version 1.1 contains a flaw that bypasses capability and nonce checks on a bulk post-password action handled by an always-loaded admin component. An attacker who can access the site, even without authentication, can invoke this action and reset or overwrite the password of every published post. This breaks confidentiality by exposing password-protected content or locks the site behind an attacker-chosen password, effectively denying legitimate users access to content they are authorized to read.

WordPress sites that have the WP Posts Password Batch Manager plugin version 1.1 or earlier installed. No additional vendor or product detail is available beyond the plugin name.

The vulnerability enables an unauthenticated attacker to invoke a bulk post-password rewrite action that bypasses all capability and nonce checks. The CVSS score of 8.6 reflects a high severity due to loss of confidentiality and availability for all posts. The EPSS score of <1% indicates that real-world exploitation is currently unlikely, yet the potential impact remains significant if an attacker succeeds. The flaw is not listed in the CISA KEV catalog, but its presence in the plugin means any WordPress site using WP Posts Password Batch Manager v1.1 or earlier is vulnerable.